WordPress Elementor Page Builder 授权问题漏洞

Elementor is a WordPress page builder from the Elementor team that offers a variety of design elements and supports custom templates and more. Elementor Page Builder WordPress plugin before 4.1.7 suffers from a security vulnerability that allows unauthenticated users to log in to any user includi...

UBUNTU-CVE-2019-14828

A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that...

Intel Ethernet I210 Controller Access Control Error Vulnerability (CNVD-2021-17787)

The Intel Ethernet I210 Controller is a hardware device from Intel Corporation USA. Providing a complete network protocol stack provides the basis for enabling small groups of computers in the same LAN as well as WANs connected via routing protocols. An Access Control Error vulnerability exists i...

March 9, 2021—Hotpatch KB5001080 (OS Build 17784.1588)

None None...

The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass

The plugin was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user including admin by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even ...

HackerOne: HackerOne Jira integration plugin Leaked JWT to unauthorized jira users

Summary: HackerOne provides an application tool HackerOne for Jira, an application that allows programs to track security issues through a jira instance. After testing the integration feature in the application, it was found that the application leads to the leakage of the JWT to unauthorized...

The Weakest Link in Your Security Posture: Misconfigured SaaS Settings

In the era of hacking and malicious actors, a company's cloud security posture is a concern that preoccupies most, if not all, organizations. Yet even more than that, it is the SaaS Security Posture Management SSPM that is critical to today's company security. Recently Malwarebytes released a...

Micro Focus SUSE CaaS Platform Access Control Error Vulnerability

An Access Control Error vulnerability exists in SUSE CaaS Platform that arises from a network system or product not properly restricting access to resources from unauthorized roles...

Design/Logic Flaw

Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. This may allow a non-admin user with either ISIPRIVLOGINCONSOLE or ISIPRIVLOGINSSH privileges to exploit the vulnerability, leading to compromised cryptographic...

Intel Ethernet Controllers Access Control Error Vulnerability

Intel Ethernet Controllers is an Ethernet controller from Intel Corporation USA. An access control error vulnerability exists in the Intel 722 Ethernet Controllers, which arises from a network system or product that does not properly restrict access to resources from unauthorized roles...

CVE-2021-2009

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Roles. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change the privileges of any user of the application. This can be used to grant himself administrative role or remove the administrative account of the application...

CentOS 8 : mysql:8.0 (CESA-2019:2511)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2511 advisory. - mysql: Server: Optimizer unspecified vulnerability CPU Jan 2019 CVE-2019-2420, CVE-2019-2481, CVE-2019-2507, CVE-2019-2529, CVE-2019-2530 - mysql:...

WordPress uListing plugin <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion vulnerability

Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion vulnerability found by Jerome Bruandet in WordPress uListing plugin versions = 1.6.6. Solution Update the WordPress uListing plugin to the latest available version at least 1.7...

uListing < 1.7 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion

The /1/api/ulisting-user/role/save REST route did not perform capability and CSRF checks, allowing unauthenticated users to remove and add roles, as well as add capabilities to the blog...

Shopify: [h1-2102] Break permissions waterfall

Summary: Shopify Plus User permission roles will propagate changes to all the users in the role Its possible to break this If you pass FULL along with other Pemrissions into a user role edit It will propagate to the users and give them full access while the role shows partial access Steps To...

UBUNTU-CVE-2021-2009

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Roles. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2021-2009

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Roles. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

CVE-2021-2009

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Roles. Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2021-04768)

Oracle MySQL is an open source relational database management system.MySQL Server mysqld is the MySQL server, the main program that performs most of the work in a MySQL installation. An unspecified vulnerability exists in the Server: Security: Roles component of Oracle MySQL Server 8.0.19 and...